Tuesday morning. A bookkeeper in Gauteng pays a supplier invoice: right supplier, right amount, the same email thread they have used for three years. Wrong bank account.
Nobody clicked a link. Nothing was hacked. No filter fired, because there was nothing to catch. The email came from a domain that had told every mail server in the world, publicly, that it did not mind who used its name.
We wanted to know how many South African businesses are in that position. So we looked at 58,769 of them.
The answer is 84.3%. More than 49,000 South African businesses can be impersonated by anyone with a laptop. Almost none of them chose that. It is how their email was set up on day one, and nobody has looked at it since.
The complete numbers are in the South African Email Security Census 2026. Or check your own domain now. It is free and runs in your browser.
Three records decide who can use your name
Whether a stranger can send email as your company comes down to three small entries in your domain’s DNS.
- SPF is the guest list: the servers allowed to send mail for you.
- DKIM is a tamper-proof signature on every message you send.
- DMARC is the instruction to the receiving server for anything that fails those checks: deliver it, junk it, or refuse it.
Almost everyone has a guest list. 92% publish SPF. The trouble is the last line. Only 26% end it with a hard fail, the part that says “turn everyone else away”. Half end with a soft fail, which a receiving server reads as “let them in, and maybe make a note”.
DMARC is where it collapses. 41% publish a record, but only 16% publish one that does anything. The
rest sit on p=none: receivers get no instruction to refuse the forged invoice, and a
report about it goes to an inbox nobody reads.
Fully closed, meaning DMARC on reject and SPF on hard fail, is 3.6%. That is 2,091 of the 58,299 domains that receive email. Every other business has left at least one door open, and the receiving server is left to guess.
Nobody chose this. It’s the default.
Company size does not predict any of this. Who runs your mail does.
The two biggest mail hosts in the country are among the weakest. xneelo runs more South African business email than Microsoft does, and enforces DMARC on 12% of it. Afrihost enforces on 3%.
Microsoft 365 and Google Workspace set up SPF for you. DKIM is a manual step most customers never take, and neither platform creates a DMARC record. 26% and 14% of their domains enforce.
Some hosts do create a DMARC record for you, set to monitor only. Elitehost publishes DMARC for 96% of its domains and enforces on 7%. IONOS, the former 1&1: 87% and 9%. Cloudflare: 80% and 6%. The record earns a green tick in every checker and stays that way for years. Those customers look protected. They are not.
One platform proves it is a choice. RDSA runs its mail service inside xneelo’s own network and enforces DMARC on 96% of its domains. The other xneelo-hosted domains sit at 6%. Same data centre, same kind of customer, fifteen times the protection, decided entirely by a default.
Whether your domain can be forged today was settled by a setting you never saw. Nobody goes back to check a default.
“Security included” rarely includes this
Most small businesses outsource their IT, and the contract says security is included. In the agreements we have read, that means antivirus, backups, patching and a spam filter.
That is not a criticism of IT providers. It is what a bundle is. A bundle is priced flat, run for uptime and driven by tickets. Security work is the opposite: it is adversarial, and when it is missing it raises no tickets at all. A domain left on monitor for six years never causes an outage. It shows up the day your customer pays a forged invoice.
These three records are the clearest example. They live in DNS, and four different parties can each say DNS is someone else’s job: the registrar, the web host, the mail host and the IT provider. The 84% is the sum of those assumptions.
The same gap runs through the rest of the bundle. The CISA advisory on managed service providers exists because attackers worked out that one provider is a door into hundreds of clients. The 2021 Kaseya incident reached about 1,500 businesses through their IT providers in a single weekend. Bundled security is only as strong as the provider’s own, and most clients have never asked about that either.
Email is where it matters most. Every quote, invoice, contract and bank detail moves through it, and it is the most common way in. CISA, the FBI and the NSA name phishing as the most common initial access technique they see. The Verizon Data Breach Investigations Report finds a human element, usually a person acting on a message, in about two thirds of breaches. And the FBI’s own figures put business email compromise second only to investment fraud in losses, year after year, and first among crimes that arrive in a work inbox. The spam filter in the bundle was built for viruses and bad links. The message that costs you money carries neither.
Five questions for your IT provider
You do not need to understand the records to ask about them. Send your provider the result for your domain, and ask:
- Who owns our DNS?
- Why is our DMARC policy not on reject, and when will it be?
- Is DKIM switched on for every system that sends email as us?
- Who reads our DMARC reports?
- What does “security included” actually cover?
A good provider will have the DNS fixed in an afternoon.
Then ask the question the bundle cannot answer: what looks at the intent of a message that passes every check? That is what SIFT does. It reads what an email is asking for, holds anything that asks for money, bank details or access, and tells you in plain English why. It sits alongside whatever filter you already have, and whoever runs your IT.
Why this is your problem too
Nobody defrauds you with your own domain. They use a supplier’s, a lawyer’s or a bank’s. Your suppliers are in the 84%. So is the conveyancer handling your property transfer. A forged invoice from them arrives with nothing telling your mail server to refuse it. Whether it lands is left to your filter’s judgement, and it looks exactly like every other email they have ever sent you.
The FBI logged $3.05 billion of this kind of fraud in 2025, across 24,768 complaints: about $123,000 a case. Nothing was hacked. Someone was asked to pay, and paid.
Fixing DNS still wouldn’t save you
If every domain in the country were fixed tomorrow, the most expensive frauds would still get through, because they forge nothing. The attacker gets into a real supplier’s mailbox, replies inside a real thread, and asks you to update the bank details on an invoice you were already expecting.
SPF, DKIM and DMARC all pass, because the sender is real. There is no link and no attachment, so your filter finds nothing. “Check the sender” is useless advice here: the sender is genuine.
What to do
1. Stop your own domain being forged. Move SPF to a hard fail, switch DKIM on, take DMARC to quarantine and then reject, and turn on the reports. It protects your customers and your name, and it is an afternoon of DNS work. Check your domain to see which steps are still open.
2. Judge what arrives by what it asks for. Is this message asking us to move money, change bank details or hand over access? Does that fit how this sender normally behaves? That is a different control from a spam filter, and it is the one that catches the invoice nobody bothered to attach malware to.
You cannot make your suppliers fix their DNS. You can stop treating a familiar-looking email as a trusted one.